CVE-2026-115241

Name of the Vulnerable Software and Affected Versions WPvivid — Backup, Migration & Staging versions prior to 0.9.137

Description An issue exists where the plugin fails to verify if a submitted snapshot identifier corresponds to a snapshot created by the plugin before using it as a database table-name prefix in DROP TABLE queries. An authenticated administrator can exploit this by providing the site's table prefix or any other string, allowing them to drop arbitrary database tables, including core WordPress tables, which leads to complete site destruction.

Recommendations Update WPvivid — Backup, Migration & Staging to version 0.9.137 or later.